AIKIDO-2026-101470

noyalib is vulnerable to Improper Input Validation

Improper Input Validation Pre-CVE Published Jul 17, 2026

Medium Risk

This Affects:

noyalib

0.0.1 - 0.0.13

Fixed in 0.0.14

Are you affected? Scan for Free

TL;DR

Affected versions of noyalib silently collapse distinct-typed YAML mapping keys on the default from_str::<Value> path. Keys that stringify to the same spelling (for example integer 1 and string "1", or true and "true") overwrite each other, causing silent data loss. The same NoSpanLoader fast path also skipped DoS budgets (max_sequence_length, max_mapping_keys, max_merge_keys, max_documents, and the alias-bytes billion-laughs cap), so crafted input could exhaust CPU or memory. Separately, CST set / set_value could write through an alias reference and corrupt a different key's value. Version 0.0.14 raises Error::KeyCollision, enforces the budgets on the Value path, and refuses alias-backed CST edits.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you parse untrusted YAML with from_str::<Value> (or mutate CST documents with set / set_value).